IB/rxe: Hold refs when running tasklets
authorAndrew Boyer <andrew.boyer@dell.com>
Mon, 5 Dec 2016 13:43:21 +0000 (08:43 -0500)
committerDoug Ledford <dledford@redhat.com>
Mon, 12 Dec 2016 21:34:22 +0000 (16:34 -0500)
commit37f69f43fb5aba4288d38ea32bbe0dfdb412c763
treee7d01aaa85ce347d6858ad09c3369b0580b2ccd2
parent07bf9627d5f1c0334fc543a5435a31a3b5907944
IB/rxe: Hold refs when running tasklets

It might be possible for all of a QP's references to be dropped
while one of that QP's tasklets is running.

For example, the completer might run during QP destroy.
If qp->valid is false, it will drop all of the packets on
the resp_pkts list, potentially removing the last reference.
Then it tries to advance the SQ consumer pointer. If the
SQ's buffer has already been destroyed, the system will
panic.

To be safe, hold a reference on the QP for the duration
of each tasklet.

Signed-off-by: Andrew Boyer <andrew.boyer@dell.com>
Signed-off-by: Doug Ledford <dledford@redhat.com>
drivers/infiniband/sw/rxe/rxe_comp.c
drivers/infiniband/sw/rxe/rxe_req.c
drivers/infiniband/sw/rxe/rxe_resp.c